CC-SET-012: Invalid sandbox.credentials Setting

Summary

• Rule ID: CC-SET-012
• Severity: MEDIUM
• Category: Claude Settings
• Normative Level: MUST
• Auto-Fix: No
• Verified On: 2026-06-25

Applicability

• Tool: claude-code
• Version Range: >=2.1.187
• Spec Revision: unspecified

Evidence Sources

• https://github.com/anthropics/claude-code/releases/tag/v2.1.187
• https://code.claude.com/docs/en/settings
• https://code.claude.com/docs/en/sandboxing

Test Coverage Metadata

• Unit tests: true
• Fixture tests: false
• E2E tests: false

Examples

The following examples demonstrate what triggers this rule and how to fix it.

Invalid

{
  "sandbox": {
    "credentials": {
      "files": [
        {"path": "~/.aws/credentials", "mode": "allow"}
      ],
      "envVars": [
        {"name": "GITHUB_TOKEN"}
      ]
    }
  }
}

Valid

{
  "sandbox": {
    "credentials": {
      "files": [
        {"path": "~/.aws/credentials", "mode": "deny"}
      ],
      "envVars": [
        {"name": "GITHUB_TOKEN", "mode": "deny"}
      ]
    }
  }
}